Product by Joomla! Project

    Joomla! CMS

    137 known vulnerabilities in Joomla! CMS (Joomla! Project), 1 of them actively exploited (CISA KEV).

    Key figures

    137

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    18

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Joomla! CMS (Joomla! Project)
    CriticalCVE-2023-23752

    [20230201] - Core - Improper access check in webservice endpoints

    In CISA KEValso in 1 other product

    		5.3
    CriticalCVE-2026-35223

    Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints

    also in 2 other products

    		9.8
    CriticalCVE-2026-40383

    Joomla! Core - [20260509] - LFI in HTMLView layout parameter

    also in 2 other products

    		9.8
    CriticalCVE-2026-48904

    Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints

    also in 2 other products

    		9.8
    CriticalCVE-2020-35613

    [20201104] - Core - SQL injection in com_users list view

    also in 1 other product

    		9.8
    MediumCVE-2024-21726

    [20240205] - Core - Inadequate content filtering within the filter code

    also in 1 other product

    		6.5
    MediumCVE-2024-21725

    [20240204] - Core - XSS in mail address outputs

    also in 1 other product

    		6.1
    MediumCVE-2021-26030

    [20210401] - Core - Escape xss in logo parameter error pages

    also in 1 other product

    		6.1
    MediumCVE-2021-23124

    [20210102] - Core - XSS in mod_breadcrumbs aria-label attribute

    also in 1 other product

    		6.1
    HighCVE-2021-23132

    [20210306] - Core - com_media allowed paths that are not intended for image uploads

    also in 1 other product

    		7.5
    HighCVE-2020-35616

    [20201107] - Core - Write ACL violation in multiple core views

    also in 1 other product

    		7.5
    CriticalCVE-2026-73373

    Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

    also in 2 other products

    		9.8
    HighCVE-2022-23793

    [20220301] - Core - Zip Slip within the Tar extractor

    also in 1 other product

    		7.5
    CriticalCVE-2022-23799

    [20220307] - Core - Variable Tampering on JInput $_REQUEST data

    also in 1 other product

    		9.8
    CriticalCVE-2021-23128

    [20210302] - Core - Potential Insecure FOFEncryptRandval

    also in 1 other product

    		9.1
    CriticalCVE-2021-23127

    [20210301] - Core - Insecure randomness within 2FA secret generation

    also in 1 other product

    		9.1
    CriticalCVE-2022-23795

    [20220303] - Core - User row are not bound to a authentication mechanism

    also in 1 other product

    		9.8
    CriticalCVE-2022-23797

    [20220305] - Core - Inadequate filtering on the selected Ids

    also in 1 other product

    		9.8
    HighCVE-2020-35612

    [20201103] - Core - Path traversal in mod_random_image

    also in 1 other product

    		7.5
    HighCVE-2021-23131

    [20210305] - Core - Input validation within the template manager

    also in 1 other product

    		7.5
    HighCVE-2020-35610

    [20201101] - Core - com_finder ignores access levels on autosuggest

    also in 1 other product

    		7.5
    HighCVE-2020-35611

    [20201102] - Core - Disclosure of secrets in Global Configuration page

    also in 1 other product

    		7.5
    HighCVE-2026-73337

    Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

    also in 2 other products

    		7.5
    HighCVE-2026-48958

    Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints

    also in 2 other products

    		8.8
    HighCVE-2026-92222

    Joomla! CMS: Server-Side Request Forgery (SSRF)

    also in 2 other products

    		8.0

    All vulnerabilities in search

    News

    All products by Joomla! Project